tcpdump filter avanzado

sudo tcpdump -i <if> 'tcp[13] & 4!=0' -w rst.pcap

Capture only TCP packets with the RST flag using BPF filters on header bytes, to measure scans and rejected connections.

Run it when you want to see RSTs (rejected connections) without the noise of normal traffic: the BPF filter tcp[13] & 4 != 0 examines byte 13 of the TCP header (the flags byte) and captures only packets with RST active. RSTs are the signature of scans (the host rejecting closed ports), connections blocked by the firewall, and dying services. In hunting, a spike of RSTs to a host from many IPs is an ongoing scan; RSTs from a specific service reveal problems. It's the example of advanced BPF filters: direct header manipulation to express what port filters can't.

Don't use it without understanding TCP flags: the filter captures RSTs, but RSTs are also part of normal behavior (connections to closed ports, session resets) — volume and context decide if it's a scan or noise. On busy interfaces, capturing only RSTs is cheap, but the subsequent analysis of who originates them requires correlation with firewall or service logs. And watch out: tcp[13] & 4 != 0 captures RSTs in both directions; if you only care about those received by your host, add the direction. For the full scan picture, combine with SYNs (tcp[13] & 2 != 0) and with the firewall log.